github.com/traefik/traefik/v3: Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth

Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. Since v3.7.13, an Ingress carrying the nginx.ingress.kubernetes.io/ssl-passthrough: "true" annotation gets, besides its TCP passthrough router, an HTTP router on the non-TLS entry points that proxies to the backend. That router was built outside the regular per-rule processing, so the access-control annotations set on the same Ingress, such as auth-type with auth-secret, auth-url and whitelist-source-range, were parsed but never turned into middlewares on it. An unauthenticated client reaching the HTTP entry point with the Ingress host could therefore reach a backend the operator had annotated as protected, with no authentication and no source allow-listing applied, and nothing logged. The HTTP side of an ssl-passthrough Ingress is now built like any other Ingress, with its annotation directives applied; the routers it generates are renamed as a result, see the v3.7.14 migration guide. Traefik v2 and Traefik v3 versions before v3.7.13 are not affected.

Patches

• https://github.com/traefik/traefik/releases/tag/v3.7.14

For more information

If you have any questions or comments about this advisory, please open an issue.